Platform & Infrastructure Engineer
Building secure Kubernetes platforms, automated infrastructure fleets, and GPU-backed edge systems.
01About
I'm an infrastructure and DevOps engineer who turns high-level designs into single-press deployments. My day job is store-edge Kubernetes running GPU-backed AI; my craft is the automation, GitOps and network policy that make a fleet behave the same way every time. I've run global infrastructure at enterprise scale — a thousand VMs, multi-region migrations, segmented networks — and I bring that same rigour to the smallest edge node. I'm an IaC enthusiast: if it's a manual step, I want it gone.
Woolworths
Core DevOps infrastructure engineer for store-edge solutions — turning high-level designs into single-press deployments and CD pipelines.
Virtus Health
Global IT — optimisation, implementation and projects across an enterprise estate.
Linde Asia Pacific
Maintained and modernised global infrastructure to enterprise standards across the region.
+ 2 earlier roles (ELGAS, Darktime).
02Capabilities
FLAGSHIP
Serving vision and language models on real hardware at the edge.
Kubernetes platforms designed to be reasoned about and recovered.
Single-touch deployments — removing the manual step, not documenting it.
Default-deny, segmentation, and a small attack surface.
Hybrid estates across the major clouds, with identity done properly.
Knowing the system is healthy — and the GPUs with it.
03Selected work
The argument: Turned a high-level edge-AI design into a single-press deployment running on Kubernetes at the store edge.
The argument: A production-grade homelab — GitOps from bare metal to local AI, and the platform that serves this very site.
The argument: Stood up identical edge sites from code — every store comes up the same way, every time.
04Writing
Lessons from edge Kubernetes, GPUs, and running infrastructure like it matters — written up as I go.
Every box in this fleet runs an OS with no shell, no package manager, and no SSH daemon — the entire machine is an API with a declarative config. It sounds like giving up control. It's the opposite: you can't drift what you can't touch.
Everyone writes network policy from the architecture diagram, and the diagram is always wrong. The only allowlist that survives contact with production is one written from the flows you actually watched — applied out-of-band, proven enforcing, and only then handed to GitOps.
A LoadBalancer service with the default traffic policy rewrites every incoming packet's source to the node's own address — so by the time a network policy sees it, the real client is gone. You cannot allowlist a sender the network has already erased.
05Get in touch
Open to conversations about platform engineering, edge infrastructure, and GPU/AI systems. Based in Sydney, Australia — for a low-ms reply, ping me on LinkedIn or email; everything else is best-effort delivery.
[email protected]
